CVE-2026-65014 Details
Description
n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.
An authentication bypass vulnerability has been identified in n8n versions prior to 2.28.0 and in 2.27.4 on the 2.27.x branch. The issue arises because the DELETE /${restEndpoint}/test-webhook/:id endpoint is registered before authentication middleware is applied. This flaw allows any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. While this disruption affects in-progress test sessions, it does not impact production webhooks, persistent workflow state, or stored data.
Users should upgrade to n8n version 2.28.0 or 2.27.4 and above on the 2.27.x branch. If an immediate upgrade is not possible, consider restricting network access to trusted users only or placing the n8n instance behind a reverse proxy or firewall that requires authentication before accessing the REST API.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-33q9-f52j-gc75 | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-test-webhook | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | >= 2.27.0, < 2.27.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | New CVE Received | [email protected] |